@evandu/super-pi 0.1.133 → 0.1.135

package/dist/client/index.html

@@ -8,8 +8,8 @@
     <link rel="alternate icon" href="/favicon.ico" />
     <link rel="apple-touch-icon" href="/favicon.svg" />
     <title>Super Pi</title>
-    <script type="module" crossorigin src="/assets/index-YEN4ysHF.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-D3MEG8uH.css">
+    <script type="module" crossorigin src="/assets/index-Dyta-HkQ.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-V93Kzott.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/server/active-memory.d.ts

@@ -61,6 +61,7 @@ export declare class ActiveMemory {
     }): string;
     release(token: string): void;
     private identity;
+    private hasWorkspace;
     search(workspaceId: string, query: string, sessionId?: string): {
         conversationId: string;
         title: string;

package/dist/server/active-memory.js

@@ -109,10 +109,14 @@ export class ActiveMemory {
     release(token) { this.capabilities.delete(token); }
     identity(token) {
         const identity = this.capabilities.get(token);
-        if (!identity || !this.store.snapshot().workspaces.some(w => w.id === identity.workspaceId))
+        if (!identity || !this.hasWorkspace(identity.workspaceId))
             throw new Error("记忆授权已失效");
         return identity;
     }
+    hasWorkspace(workspaceId) {
+        const store = this.store;
+        return store.hasWorkspace ? store.hasWorkspace(workspaceId) : store.snapshot().workspaces.some(w => w.id === workspaceId);
+    }
     search(workspaceId, query, sessionId) {
         const words = query.toLocaleLowerCase().match(/[\p{L}\p{N}_-]{2,}/gu)?.slice(0, 12) ?? [];
         if (!words.length)
@@ -232,7 +236,7 @@ export class ActiveMemory {
         return alreadyLocked ? work() : this.locked(work);
     }
     async manage(workspaceId, body) {
-        if (!this.store.snapshot().workspaces.some(w => w.id === workspaceId))
+        if (!this.hasWorkspace(workspaceId))
             throw new Error("工作区不存在");
         if (body.action === "configure") {
             await this.configure(body.settings);

package/dist/server/application/run-service.d.ts

@@ -61,6 +61,7 @@ export declare class RunService {
     private readonly extensionUiService;
     private agentsDir;
     private readonly workflows;
+    private readonly questionWaiters;
     private memory?;
     setMemory(memory: import("../active-memory.js").ActiveMemory): void;
     /**
@@ -178,6 +179,9 @@ export declare class RunService {
         answers?: QuestionAnswer[];
         cancelled?: boolean;
     }): Promise<void>;
+    private questionKey;
+    private answerPayload;
+    private settleQuestion;
     /**
      * THE `question` TOOL BLOCKS HERE, ON THE CALL THAT ASKED IT.
      *

package/dist/server/application/run-service.js

@@ -6,6 +6,7 @@ import { verifyCapability } from "../capability.js";
 import { validateWorkflowPlan, workflowSummary } from "../workflow.js";
 import { ensureNameIndex } from "../file-name-index.js";
 import { formatTurnFailure } from "../turn-failure.js";
+import { describeThrownWithStack } from "../failure-text.js";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 const execFileAsync = promisify(execFile);
@@ -84,6 +85,7 @@ export class RunService {
     extensionUiService;
     agentsDir;
     workflows;
+    questionWaiters = new Map();
     memory;
     setMemory(memory) { this.memory = memory; }
     /**
@@ -238,52 +240,32 @@ export class RunService {
                     this.broadcaster.broadcastState();
                     return row;
                 });
-                // AUTO-TRIGGER WHEN IDLE. The conversation may already be busy (running turn, taking the next
-                // waiting message in its own follow-up loop); if so, the existing loop picks this one up and
-                // this branch is a no-op. If idle, kick off a fresh turn so the model processes the result
-                // without the user having to send anything - the failure case is intentionally included: the
-                // model seeing "[后台任务 X 失败]" is part of the same "after current AI finishes, automatically
-                // processes the result" contract, and the auto-triggered turn goes through the same
-                // `composePrompt` path the success case does (so a helper failure surfaces as `state="error"`
-                // prose the agent can react to).
-                // EXACTLY ONE DELIVERY PER RESULT. The custom channel hands the result straight to Pi's own
-                // follow-up queue, but it knows nothing about the `waiting` row queued above, and
-                // `takeNextWaitingMessage` knows nothing about Pi's queue - so delivering through the channel
-                // while leaving the row waiting gave the model the SAME result twice (once as the custom
-                // message, once as the row's own prose turn). Measured by
-                // scripts/background-result-delivery.test.mjs. So a successful custom delivery CONSUMES the row,
-                // and a failed one - `SteerUnavailableError`, which is what oneshot mode and a not-yet-created
-                // session throw - falls back to the queue path, the same semantics the sub-agent result path
-                // (processWaitingMessage only) has always had.
-                let deliveredViaCustom = false;
-                const custom = this.runtime.sendCustomMessage;
-                if (custom) {
-                    try {
-                        await custom.call(this.runtime, task.conversationId, {
-                            customType: "super-pi-task-result",
-                            content: body,
-                            display: "后台任务结果",
-                            details: { taskId: sessionId, source: "exec", state: exitCode === 0 ? "completed" : "error", summary: task.title },
-                        });
-                        deliveredViaCustom = true;
-                    }
-                    catch (error) {
-                        console.warn(`Super Pi: custom delivery of the exec result failed, the queue path takes over: ${error instanceof Error ? error.message : "unknown error"}`);
-                    }
-                }
-                if (deliveredViaCustom) {
-                    await this.store.takeWaitingMessage(task.conversationId, queued.id);
-                }
-                else if (!this.activeRuns.has(task.conversationId) && !this.interruptTargets.has(task.conversationId)) {
+                // THE RESULT WAITS IN SUPER PI'S OWN QUEUE, AND THE QUEUE IS DRAINED ONE TURN AT A TIME.
+                //
+                // It used to go to Pi's own follow-up queue, and Pi DRAINS that queue all at once when a turn
+                // ends - the pending messages are collected into one array and fed to the model as a single
+                // turn. So two background results that finished close together were handed over TOGETHER, and
+                // the agent answered both at once (ledger TEST-033). That path also had a second defect of its
+                // own: Pi's queue knows nothing about the `waiting` row queued above, so delivering through it
+                // while leaving the row waiting gave the model the SAME result twice (ledger TEST-011).
+                //
+                // So the result is not delivered through that channel at all. It stays a `waiting` row, and
+                // Super Pi's own loop takes waiting messages ONE PER TURN - which is what that loop was built
+                // for, and what the sub-agent result path has always done.
+                //
+                // IDLE: a turn of its own starts now, so the model processes the result without the user
+                // having to send anything. The failure case is included on purpose: the model seeing
+                // "[后台任务 X 失败]" is part of the same "after the current answer finishes, the result is
+                // processed automatically" contract, and the auto-triggered turn goes through the same
+                // `composePrompt` path the success case does.
+                if (!this.activeRuns.has(task.conversationId) && !this.interruptTargets.has(task.conversationId)) {
                     void this.processWaitingMessage(task.conversationId, queued.id).catch((error) => {
                         console.warn(`Super Pi: auto-trigger for background exec result failed: ${error instanceof Error ? error.message : "unknown error"}`);
                     });
                 }
-                else {
-                    // THE CONVERSATION IS BUSY, so the run that is going answers this result itself - through
-                    // Pi's own follow-up queue, so the result does not have to wait for a turn of its own.
-                    await this.submitToPiQueue(task.conversationId, queued);
-                }
+                // BUSY: the row stays in the waiting queue, and the turn that is running takes it when that
+                // turn ends - one message per turn, in the queue's own order. Nothing of a background result
+                // goes into Pi's follow-up queue any more.
             }
             catch (error) {
                 console.warn(`Super Pi: exec result could not be appended as a tool message: ${error instanceof Error ? error.message : "unknown error"}`);
@@ -374,7 +356,7 @@ export class RunService {
      * other tool update uses - and the client can only get that index from the row it is already rendering.
      */
     async answerQuestion(command) {
-        const existing = this.store.snapshot().conversations.find((item) => item.id === command.conversationId)?.messages.find((item) => item.id === command.messageId)?.toolCalls?.[command.callIndex]?.question;
+        const existing = this.store.question(command.conversationId, command.messageId, command.callIndex);
         if (!existing)
             throw new Error("这个工具调用不是一个问题");
         const calls = await this.store.updateToolCall(command.conversationId, command.messageId, command.callIndex, {
@@ -385,6 +367,30 @@ export class RunService {
             },
         });
         this.broadcaster.broadcast({ type: "message.tools", conversationId: command.conversationId, messageId: command.messageId, toolCalls: calls });
+        this.settleQuestion(command.conversationId, command.messageId, command.callIndex, calls[command.callIndex]?.question);
+    }
+    questionKey(conversationId, messageId, index) {
+        return `${conversationId}\0${messageId}\0${index}`;
+    }
+    answerPayload(current) {
+        const answers = (current.answers ?? []).map((answer) => {
+            const asked = current.items.find((item) => item.id === answer.id);
+            return { question: asked?.question, selected: answer.selected, ...(answer.note ? { note: answer.note } : {}) };
+        });
+        return { answers, summary: `用户回答：${answers.map((answer) => answer.selected.join("、")).join("；")}` };
+    }
+    settleQuestion(conversationId, messageId, index, question) {
+        if (!question || question.status === "pending")
+            return;
+        const key = this.questionKey(conversationId, messageId, index);
+        const waiter = this.questionWaiters.get(key);
+        if (!waiter)
+            return;
+        this.questionWaiters.delete(key);
+        if (question.status === "answered")
+            waiter.resolve(this.answerPayload(question));
+        else
+            waiter.reject(new Error("用户没有回答这个问题"));
     }
     /**
      * THE `question` TOOL BLOCKS HERE, ON THE CALL THAT ASKED IT.
@@ -414,28 +420,13 @@ export class RunService {
         //
         // So the lookup WAITS. A few hundred milliseconds of polling covers the drain, and a question that
         // genuinely has no pending call still fails - just not instantly.
-        const findCall = () => {
-            const conversation = this.store.snapshot().conversations.find((item) => item.id === conversationId);
-            const message = conversation?.messages.slice().reverse().find((item) => item.role === "assistant");
-            if (!message)
-                return undefined;
-            for (let i = (message.toolCalls?.length ?? 0) - 1; i >= 0; i -= 1) {
-                const call = message.toolCalls?.[i];
-                if (call?.label === "question" && call.question?.status === "pending")
-                    return { messageId: message.id, index: i };
-            }
-            return undefined;
-        };
         let found;
         for (let attempt = 0; attempt < 50 && !found; attempt += 1) {
-            found = findCall();
+            found = this.store.pendingQuestion(conversationId);
             if (found)
                 break;
             await new Promise((resolve) => setTimeout(resolve, 100));
         }
-        const conversation = this.store.snapshot().conversations.find((item) => item.id === conversationId);
-        if (!conversation?.messages.length)
-            throw new Error("No active assistant message");
         if (!found)
             throw new Error("这个会话里没有正在等待回答的 question 工具调用");
         const { messageId, index } = found;
@@ -445,29 +436,7 @@ export class RunService {
             // continuing from a question that was never decided). The run-level teardown (stop / abort /
             // shutdown) clears the underlying ask and the client settles it as cancelled, which lands here
             // and rejects. A question that is simply unanswered waits indefinitely.
-            const poll = setInterval(() => {
-                const current = this.store.snapshot().conversations.find((item) => item.id === conversationId)?.messages.find((item) => item.id === messageId)?.toolCalls?.[index]?.question;
-                if (current?.status === "answered") {
-                    clearInterval(poll);
-                    resolve(answerPayload(current));
-                }
-                else if (current?.status === "cancelled") {
-                    clearInterval(poll);
-                    reject(new Error("用户没有回答这个问题"));
-                }
-            }, 250);
-            // WHAT GOES BACK TO THE MODEL IS WRITTEN FOR THE MODEL. The answers pair to their questions by id,
-            // which is what stops a person answering the second of two being recorded against the first - but an
-            // id is a UUID, and a model handed `{answers:[{id:"671b0f0b-…", selected:["发"]}]}` has to guess at
-            // what that means. It guessed, and reported a real answer as a cancellation. So the answer goes back
-            // as its questions and its choices, with a sentence naming the outcome.
-            const answerPayload = (current) => {
-                const answers = (current.answers ?? []).map((answer) => {
-                    const asked = current.items.find((item) => item.id === answer.id);
-                    return { question: asked?.question, selected: answer.selected, ...(answer.note ? { note: answer.note } : {}) };
-                });
-                return { answers, summary: `用户回答：${answers.map((answer) => answer.selected.join("、")).join("；")}` };
-            };
+            this.questionWaiters.set(this.questionKey(conversationId, messageId, index), { resolve, reject });
         });
     }
     /**
@@ -571,6 +540,7 @@ export class RunService {
         // Abort immediately before waiting for the conversation lane; otherwise a stop queued behind a
         // long streaming command could never reach the controller that it is meant to cancel.
         this.activeRuns.get(conversationId)?.abort();
+        this.broadcaster.broadcast({ type: "run.stopping", conversationId });
         await this.runtime.stop?.(conversationId);
         return this.serializeConversation(conversationId, () => this.stopRunUnsafe(conversationId));
     }
@@ -591,9 +561,9 @@ export class RunService {
                     continue;
                 const calls = await this.store.updateToolCall(conversationId, message.id, index, { question: { items: question.items, status: "cancelled" } });
                 this.broadcaster.broadcast({ type: "message.tools", conversationId, messageId: message.id, toolCalls: calls });
+                this.settleQuestion(conversationId, message.id, index, calls[index]?.question);
             }
         }
-        await this.store.setStatus(conversationId, "stopped");
         if (this.subagents.stopConversation(conversationId)) {
             console.log(`Super Pi: stopped the sub-agent runs of conversation ${conversationId}.`);
         }
@@ -603,6 +573,17 @@ export class RunService {
         if (this.workflows.stopConversation(conversationId)) {
             console.log(`Super Pi: stopped the running orchestration plans of conversation ${conversationId}.`);
         }
+        // AWAIT RUN SLOT RELEASE BEFORE CLAIMING "STOPPED".
+        // A stop previously called setStatus("stopped") immediately, while activeRuns still held the
+        // conversation slot and the streaming lane was still draining. This produced the contradiction:
+        // the UI displayed 「已停止」 and offered 「发送」, but sending a new message hit an active
+        // run slot and was falsely placed into 「排队中」, while the previous turn might still produce text.
+        await this.awaitRunSlotReleased(conversationId, false, 3_000);
+        if (this.activeRuns.has(conversationId)) {
+            console.warn(`Super Pi: run slot for conversation ${conversationId} not released after stop deadline; force-releasing.`);
+            this.releaseRunSlot(conversationId);
+        }
+        await this.store.setStatus(conversationId, "stopped");
         this.broadcaster.broadcastState();
     }
     /**
@@ -777,14 +758,29 @@ export class RunService {
         // long tool execution. The flag is the only way to make the flip one-shot: calling `setStatus` on
         // every delta would be a per-token status write.
         let firstSignal = true;
+        /**
+         * Promotes the turn to `running`, and ANSWERS WHETHER IT PUBLISHED A STATE SNAPSHOT.
+         *
+         * The answer matters because a state snapshot and a live event are two carriers of the same
+         * information: the snapshot is the whole truth (it carries the text, the thinking and the block
+         * boundaries), and a live `message.delta` / `message.thinking` event is an increment on top of it.
+         * A caller that has ALREADY put a delta into the store must therefore not also publish it as a
+         * live event, or the browser receives it twice and counts it twice - the reasoning the reader
+         * sees is longer than the reasoning the model wrote.
+         *
+         * So the rule is: WHOEVER PUTS THE DELTA IN THE STORE OWNS THE DELIVERY. The promotion publishes
+         * a snapshot only when it actually flips the status, and the caller asks.
+         */
         const promoteToRunning = async () => {
             if (!firstSignal)
-                return;
+                return false;
             firstSignal = false;
             if (this.store.snapshot().conversations.find((item) => item.id === conversation.id)?.status === "waiting") {
                 await this.store.setStatus(conversation.id, "running");
                 this.broadcaster.broadcastState();
+                return true;
             }
+            return false;
         };
         // Live events are independent from durable checkpoints. Persisting every token made the stdout
         // reader wait for one disk transaction per token; over a remote browser connection that backlog
@@ -1152,14 +1148,27 @@ export class RunService {
                     thinkingActive = true;
                     this.store.setThinkingActiveLive(conversation.id, assistant.id, true);
                     thought += delta.length;
+                    // THE DELTA GOES INTO THE STORE FIRST, and the promotion that follows broadcasts a state
+                    // snapshot that therefore CARRIES it - the text, the thinking and the block boundary the
+                    // browser needs to put this fragment in the right fold. That snapshot is the delta's
+                    // delivery, so the live event is not sent as well: sent twice, the browser appends the
+                    // first fragment to a copy that already has it, and the reasoning the reader sees is longer
+                    // than the reasoning the model wrote.
+                    //
+                    // THE OTHER ORDER HAD ITS OWN FAILURE, and it is why the snapshot is not simply left to
+                    // carry everything: promoting BEFORE the append publishes a snapshot WITHOUT this delta,
+                    // and the browser - which rebuilds its fold blocks from the snapshot's boundaries - then
+                    // starts a second block for the same stretch of reasoning, so one continuous train of
+                    // thought arrives as two fold bars and the tool call inside it falls out of the block it
+                    // belonged to.
+                    //
+                    // So: the snapshot carries the delta, and only the deltas the snapshot did not carry are
+                    // published live. `promoteToRunning` answers whether it published one.
                     this.store.appendThinkingDeltaLive(conversation.id, assistant.id, delta, spoken, newBlock);
-                    // THE PROMOTION COMES AFTER THE DELTA IS IN THE STORE, so the state snapshot it broadcasts
-                    // carries the same thinking the client is about to receive as a live event. Promoting first
-                    // broadcast a snapshot WITHOUT this delta, and the client - which prefers the live body only
-                    // while the conversation is running - took that stale snapshot, lost the thinking block's
-                    // boundary, and dropped a tool call out of the block it belonged to.
-                    await promoteToRunning();
-                    this.broadcaster.broadcast({ type: "message.thinking", conversationId: conversation.id, messageId: assistant.id, delta, active: true, at: spoken, blockIndex: thinkingBlock });
+                    const promoted = await promoteToRunning();
+                    if (!promoted) {
+                        this.broadcaster.broadcast({ type: "message.thinking", conversationId: conversation.id, messageId: assistant.id, delta, active: true, at: spoken, blockIndex: thinkingBlock });
+                    }
                     scheduleCheckpoint();
                 },
                 // AN EMPTY DELTA THAT ONLY CARRIES THE FLAG. `thinking_end` is a fact the browser needs and not
@@ -1324,6 +1333,12 @@ export class RunService {
         // itself as an ordinary message and now finds the slot taken - its words are on screen with nobody
         // going to answer them. Repairing that is what the guard below is for; it is not a rare path, it is
         // what two fast sends looks like from the inside.
+        // An aborted run is unwinding its slot. Wait out that brief cleanup rather than falsely
+        // treating it as an active turn and sending this message to a dying follow-up queue.
+        const active = this.activeRuns.get(conversation.id);
+        if (active?.signal.aborted) {
+            await this.awaitRunSlotReleased(conversation.id, false);
+        }
         const busy = this.activeRuns.has(conversation.id) || this.interruptTargets.has(conversation.id);
         const message = await this.store.addUserMessage(conversationId, trimmed, validImages, attachments, { clientId, ...(busy ? { delivery: "waiting" } : {}) });
         this.broadcaster.broadcastState();
@@ -1375,6 +1390,9 @@ export class RunService {
                 // waiting". The banner is cleared by the next `addUserMessage` so a stale reason cannot
                 // survive a retry into the same conversation.
                 await this.store.setFailureReason(conversationId, formatTurnFailure(error));
+                // The refusal is written for the reader, but the reader is not the only one who needs to know
+                // why a turn never started: the server log is where the stack survives.
+                console.warn("Super Pi turn refused before it started:", describeThrownWithStack(error));
                 // Status is restored here, not relied on the outer catch to handle: a preflight failure never
                 // opened a turn, so the right state is the one the conversation had a moment ago (idle). The
                 // outer catch would otherwise flip it to `failed`, which the reader would render as a turn
@@ -1424,6 +1442,9 @@ export class RunService {
             if (controller.signal.aborted)
                 return;
             await this.store.setFailureReason(conversation.id, formatTurnFailure(error));
+            // A turn that broke is the failure the reader will complain about, and the banner only carries
+            // the sentence. The stack goes to the server log, where it can still be found.
+            console.error("Super Pi turn failed:", describeThrownWithStack(error));
             throw error;
         }
         finally {
@@ -1460,8 +1481,8 @@ export class RunService {
      * and nothing more. Waiting out an arbitrarily long RUNNING turn would turn "send now" into "send
      * whenever the current answer finishes", which is what the queue is for.
      */
-    async awaitRunSlotReleased(conversationId, onlyWhileStopped = false) {
-        const deadline = Date.now() + 15_000;
+    async awaitRunSlotReleased(conversationId, onlyWhileStopped = false, timeoutMs = 15_000) {
+        const deadline = Date.now() + timeoutMs;
         while (this.activeRuns.has(conversationId) && Date.now() < deadline) {
             if (onlyWhileStopped && this.store.snapshot().conversations.find((item) => item.id === conversationId)?.status !== "stopped")
                 return;

package/dist/server/application/workspace-service.d.ts

@@ -22,9 +22,8 @@ export declare class WorkspaceService {
     private readonly catalogService;
     private readonly runService;
     private readonly extensionUiService;
-    private readonly uploadsDir;
     private agentsDir;
-    constructor(store: Store, runtime: AgentRuntime, broadcaster: EventBroadcaster, catalogService: CatalogService, runService: RunService, extensionUiService: ExtensionUiService, uploadsDir: string, agentsDir: string | string[]);
+    constructor(store: Store, runtime: AgentRuntime, broadcaster: EventBroadcaster, catalogService: CatalogService, runService: RunService, extensionUiService: ExtensionUiService, agentsDir: string | string[]);
     setAgentsDir(dir: string | string[]): void;
     /**
      * Creates a new workspace.
@@ -35,8 +34,13 @@ export declare class WorkspaceService {
      */
     renameWorkspace(workspaceId: string, name: string): Promise<void>;
     /**
-     * Deletes a workspace and cascades cleanup to active runs, subagent runs,
-     * uploaded files, and stored conversations.
+     * Takes a workspace out of the sidebar. NOTHING IS DELETED.
+     *
+     * The conversations under it, the uploads attached to them and the workspace's own defaults all
+     * stay on disk: removing a workspace from the list is a soft unmount, and adding the same
+     * folder back brings the whole history with it. What does stop is the WORK: a turn that was still
+     * running cannot keep a model session alive behind a workspace the user can no longer see, and a
+     * pending question would wait for an answer the sidebar can no longer reach.
      */
     deleteWorkspace(workspaceId: string): Promise<void>;
     /**

package/dist/server/application/workspace-service.js

@@ -1,5 +1,4 @@
 import { assertModelAllowed } from "../model-filter.js";
-import { deleteConversationUploads } from "../upload.js";
 /**
  * Service managing workspaces: creation, rename, cascade deletion, and defaults configuration.
  */
@@ -10,16 +9,14 @@ export class WorkspaceService {
     catalogService;
     runService;
     extensionUiService;
-    uploadsDir;
     agentsDir;
-    constructor(store, runtime, broadcaster, catalogService, runService, extensionUiService, uploadsDir, agentsDir) {
+    constructor(store, runtime, broadcaster, catalogService, runService, extensionUiService, agentsDir) {
         this.store = store;
         this.runtime = runtime;
         this.broadcaster = broadcaster;
         this.catalogService = catalogService;
         this.runService = runService;
         this.extensionUiService = extensionUiService;
-        this.uploadsDir = uploadsDir;
         this.agentsDir = agentsDir;
     }
     setAgentsDir(dir) {
@@ -41,21 +38,25 @@ export class WorkspaceService {
         this.broadcaster.broadcastState();
     }
     /**
-     * Deletes a workspace and cascades cleanup to active runs, subagent runs,
-     * uploaded files, and stored conversations.
+     * Takes a workspace out of the sidebar. NOTHING IS DELETED.
+     *
+     * The conversations under it, the uploads attached to them and the workspace's own defaults all
+     * stay on disk: removing a workspace from the list is a soft unmount, and adding the same
+     * folder back brings the whole history with it. What does stop is the WORK: a turn that was still
+     * running cannot keep a model session alive behind a workspace the user can no longer see, and a
+     * pending question would wait for an answer the sidebar can no longer reach.
      */
     async deleteWorkspace(workspaceId) {
         const snapshot = this.store.snapshot();
-        const doomed = snapshot.conversations.filter((c) => c.workspaceId === workspaceId);
-        for (const c of doomed) {
+        const affected = snapshot.conversations.filter((c) => c.workspaceId === workspaceId);
+        for (const c of affected) {
             this.extensionUiService.cancelPendingUi(c.id, "aborted");
             if (this.runService.isRunning(c.id)) {
                 await this.runService.stopRun(c.id);
             }
             this.runService.stopConversationSubagents(c.id);
         }
-        const doomedIds = await this.store.deleteWorkspace(workspaceId);
-        await Promise.all(doomedIds.map((id) => deleteConversationUploads(this.uploadsDir, id)));
+        await this.store.deleteWorkspace(workspaceId);
         this.broadcaster.broadcastState();
     }
     /**

package/dist/server/failure-text.d.ts

@@ -0,0 +1,18 @@
+/**
+ * THE TEXT OF A FAILURE.
+ *
+ * A server failure reaches the browser as a sentence, and the reader is entitled to know what
+ * actually went wrong. The trouble is that what was thrown is not always an `Error`: it can be a
+ * string, a plain object, a rejected promise with no reason at all. The old code answered
+ * `command failed` in those cases - the one sentence that says nothing about anything - so a real
+ * cause that had reached the server was replaced by a sentence with no cause in it.
+ *
+ * This module is the one place that decides what a thrown value turns into. It never invents
+ * text: an `Error` gives its message, a string gives itself, an object gives its `message` or its
+ * JSON, and a value that carries no information at all gives an EMPTY STRING - which the client
+ * reads as "no reason was given", and says so out loud instead of pretending.
+ */
+/** The failure as a person should read it. Empty when the thrown value carries no information. */
+export declare function describeThrown(error: unknown): string;
+/** The failure with its stack, for the log file. */
+export declare function describeThrownWithStack(error: unknown): string;

package/dist/server/failure-text.js

@@ -0,0 +1,44 @@
+/**
+ * THE TEXT OF A FAILURE.
+ *
+ * A server failure reaches the browser as a sentence, and the reader is entitled to know what
+ * actually went wrong. The trouble is that what was thrown is not always an `Error`: it can be a
+ * string, a plain object, a rejected promise with no reason at all. The old code answered
+ * `command failed` in those cases - the one sentence that says nothing about anything - so a real
+ * cause that had reached the server was replaced by a sentence with no cause in it.
+ *
+ * This module is the one place that decides what a thrown value turns into. It never invents
+ * text: an `Error` gives its message, a string gives itself, an object gives its `message` or its
+ * JSON, and a value that carries no information at all gives an EMPTY STRING - which the client
+ * reads as "no reason was given", and says so out loud instead of pretending.
+ */
+/** The failure as a person should read it. Empty when the thrown value carries no information. */
+export function describeThrown(error) {
+    if (error instanceof Error)
+        return error.message || error.name;
+    if (typeof error === "string")
+        return error;
+    if (error === null || error === undefined)
+        return "";
+    if (typeof error === "object") {
+        const message = error.message;
+        if (typeof message === "string" && message.trim())
+            return message;
+        try {
+            const text = JSON.stringify(error);
+            if (text && text !== "{}")
+                return text;
+        }
+        catch {
+            // Circular or otherwise unserializable: there is nothing better to say than "no reason".
+        }
+        return "";
+    }
+    return String(error);
+}
+/** The failure with its stack, for the log file. */
+export function describeThrownWithStack(error) {
+    if (error instanceof Error && error.stack)
+        return error.stack;
+    return describeThrown(error);
+}

package/dist/server/http-server.js

@@ -6,6 +6,7 @@ import { homedir, networkInterfaces } from "node:os";
 import { basename, dirname, extname, join, relative, resolve } from "node:path";
 import { describe as describeFilesError, fileMeta, listDirectory, MAX_FILE_BYTES, readWorkspaceFile, resolveInsideRoot, toRelative, writeWorkspaceFile, } from "./files.js";
 import { findUploadFile, MAX_UPLOAD_BODY_BYTES, saveUpload } from "./upload.js";
+import { describeThrown } from "./failure-text.js";
 import { checkDiskVersion } from "./version.js";
 import { gitBlame, gitDiff, gitLog, gitMutate, gitStatus } from "./git.js";
 import { computeFileDiff } from "./file-diff.js";
@@ -282,7 +283,7 @@ export function createHttpServer(options) {
                 return;
             }
             catch (error) {
-                json(400, { error: error instanceof Error ? error.message : "tool export failed" });
+                json(400, { error: describeThrown(error) || "导出工具失败，没有拿到失败原因。" });
                 return;
             }
         }
@@ -360,7 +361,7 @@ export function createHttpServer(options) {
                 return;
             }
             catch (error) {
-                json(400, { error: error instanceof Error ? error.message : "tool request failed" });
+                json(400, { error: describeThrown(error) || "工具请求失败，没有拿到失败原因。" });
                 return;
             }
         }
@@ -422,7 +423,7 @@ export function createHttpServer(options) {
                     toolApi(202, run);
                 }
                 catch (error) {
-                    toolApi(400, { error: error instanceof Error ? error.message : "tool run failed" });
+                    toolApi(400, { error: describeThrown(error) || "工具运行失败，没有拿到失败原因。" });
                 }
                 return;
             }
@@ -513,7 +514,7 @@ export function createHttpServer(options) {
                         toolApi(202, context.toolLlm.start({ toolId: id, prompt: body.prompt ?? "", system: body.system, timeoutMs: body.timeoutMs }));
                     }
                     catch (error) {
-                        toolApi(400, { error: error instanceof Error ? error.message : "model call failed" });
+                        toolApi(400, { error: describeThrown(error) || "模型调用失败，没有拿到失败原因。" });
                     }
                     return;
                 }
@@ -1039,6 +1040,16 @@ export function createHttpServer(options) {
                     return;
                 }
                 if (request.method === "POST") {
+                    // A GIT WRITE IS A WRITE, AND IT GETS THE SAME GATE AS EVERY OTHER WRITE. `gitMutate` can
+                    // stage, DISCARD (`git restore -- <path>`, which throws away uncommitted work), commit,
+                    // pull and PUSH - so an endpoint that skips the address predicate hands a public caller the
+                    // keys to somebody's repository. The server listens on 0.0.0.0 by default and the global
+                    // access token is OPTIONAL (`isAuthorized` passes everyone when there is none), so this
+                    // predicate IS the boundary for every other write endpoint in this file (ledger TEST-042).
+                    if (!isLocalOrPrivateAddress(remote)) {
+                        json(403, { error: "Git 写操作只允许来自本机或局域网的请求。" });
+                        return;
+                    }
                     let raw = "";
                     for await (const chunk of request)
                         raw += chunk;
@@ -1417,7 +1428,7 @@ export function createHttpServer(options) {
                 response.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify(result));
             }
             catch (error) {
-                response.writeHead(400, { "content-type": "application/json" }).end(JSON.stringify({ error: error instanceof Error ? error.message : "question failed" }));
+                response.writeHead(400, { "content-type": "application/json" }).end(JSON.stringify({ error: describeThrown(error) || "问答失败，没有拿到失败原因。" }));
             }
             return;
         }